## Predict and deploy {: #predict-and-deploy }

Once you identify the model that best learns patterns in your data to predict SARs, you can deploy it into your desired decision environment. *Decision environments* are the ways in which the predictions generated by the model will be consumed by the appropriate organizational [stakeholders](#decision-stakeholders), and how these stakeholders will make decisions using the predictions to impact the overall process. This is a critical step for implementing the use case, as it ensures that predictions are used in the real world to reduce false positives and improve efficiency in the investigation process. 

The following applications of the alert-prioritization score from the false positive reduction model both automate and augment the existing rule-based transaction monitoring system.


* If the FCC (Financial Crime Compliance) team is comfortable with removing the low-risk alerts (very low prioritization score) from the scope of investigation, then the binary threshold selected during the model-building stage will be used as the cutoff to remove those no-risk alerts. The investigation team will only investigate alerts above the cutoff, which will still capture all the SARs based on what was learned from the historical data.

* Often regulatory agencies will consider auto-closure or auto-removal as an aggressive treatment for production alerts. If auto-closing is not the ideal way to use the model output, the alert prioritization score can still be used to triage alerts into different investigation processes, improving the operational efficiency.

### Decision stakeholders {: #decision-stakeholders }

The following table lists potential decision stakeholders:

Stakeholder | Description
----------- | -----------
Decision Executors | Financial Crime Compliance Team
Decision Managers |Chief Compliance Officer
Decision Authors | Data scientists or business analysts

### Decision process {: #decision-process }

Currently, the review process consists of a deep-dive analysis by investigators. The data related to the case is made available for review so that the investigators can develop a 360° view of the customer, including their profile, demographic, and transaction history. Additional data from third-party data providers and web crawling can supplement this information to complete the picture.

For transactions that do not get auto-closed or auto-removed, the model can help the compliance team create a more effective and efficient review process by triaging their reviews. The predictions and their explanations also give investigators a more holistic view when assessing cases. 

**Risk-based Alert Triage:** Based on the prioritization score, the investigation team can take different investigation strategies. 

* For no-risk or low-risk alerts&mdash;alerts can be reviewed on a quarterly basis, instead of monthly. The frequently alerted entities without any SAR risk will be reviewed once every three months, which will significantly reduce the time of investigation.

* For high-risk alerts with higher prioritization scores&mdash;investigations can fast-forward to the final stage in the alert escalation path. This will significantly reduce the effort spent on level 1 and level 2 investigations.

* For medium-risk alerts&mdash;the standard investigation process can still be applied.

**Smart Alert Assignment:** For an alert investigation team that is geographically dispersed, the alert prioritization score can be used to assign alerts to different teams in a more effective manner. High-risk alerts can be assigned to the team with the most experienced investigators, while low-risk alerts are assigned to the less-experienced team. This will mitigate the risk of missing suspicious activities due to a lack of competency during alert investigations.

For both approaches, the definition of high/medium/low risk could be either a set of hard thresholds (for example, High: score>=0.5, Medium: 0.5>score>=0.3, Low: score<0.3), or based on the percentile of the alert scores on a monthly basis (for example, High: above 80th percentile, Medium: between 50th and 80th percentile, Low: below 50th percentile).

### Model deployment {: #model-deployment }

The predictions generated from DataRobot can be integrated with an alert management system which will let the investigation team know of high-risk transactions.

![](images/aml-biz-13.png)

### Model monitoring {: #model-monitoring }

DataRobot will continuously monitor the model deployed on the dedicated prediction server. With DataRobot [MLOps](mlops/index), the modeling team can monitor and manage the alert prioritization model by tracking the distribution drift of the input features as well as the performance deprecation over time.

![](images/aml-biz-14.png)

### Implementation considerations {: #implementation-considerations }

When operationalizing this use case, consider the following, which may impact outcomes and require model re-evaluation:

* Change in the transactional behavior of the money launderers.
* Novel information introduced to the transaction, and customer records that are not seen by the machine learning models.